Privacy note
A plain explanation of the information we hold.
This is a draft, and it has not been checked by a lawyer.
It was written by us, not by a lawyer, and it still has to be reviewed by a qualified Australian lawyer before a customer relies on it. The Privacy Act 1988 has rules about what a privacy notice must contain, and this note has not been checked against them. Every square-bracket blank below has to be filled in, and anything marked [to be confirmed] is not a fact yet.
What we hold about you
Two small piles, and they do not mix.
On your own server
Everything you actually do with the assistant: your work, your files, your conversations with it. That pile is yours, and it sits on the machine we rent for you. We do not copy it into our console or billing records. The encrypted nightly backup is the only data we hold away from your server, and it is encrypted before it leaves the machine.
In our billing records
The basics we need to charge you and keep the tax office happy: your name, email address, billing address, your server plan, your credit top-ups and balance, what you have paid, and the fact that you became a customer. We do not need, and do not keep, your card number. [PAYMENTS PROVIDER] holds that, not us.
Where it lives
- Your own box: [SERVER REGION], hosted by [HOSTING PROVIDER]. That is where your content is.
- Our billing records: our own small systems, and [PAYMENTS PROVIDER]'s records for the payments themselves.
What we never do
- We do not read your content, or look at your work, for any purpose of ours.
- We do not sell your information to anyone, ever.
- We do not use your content to train any AI model, ours or anyone else's.
- We do not hand your data to a third party to advertise to you.
- We do not give your details to another customer, or use one customer's data to serve another.
Who else touches it
- [HOSTING PROVIDER] rents us the machine. They hold the disk your data sits on. [to be confirmed: what their own terms let them do with data on their hardware]
- [GATEWAY PROVIDER] runs the small gateway that passes your AI requests through, using our keys. It handles the traffic, not your stored work.
- [PAYMENTS PROVIDER] takes your payment. They hold your card details; we never see them.
- The AI model providers, [AI MODEL PROVIDER(S)]. These are the ones to look at closely. When the assistant asks a model to do something, the words of that request leave your server and go to the model provider's systems. That is how the assistant works. They see the content of the request.
Do the model providers train on what they see?
This is a question, not a promise. We have not yet had a written answer from every provider about whether content sent through a commercial API account may be used to train their models, and for how long they keep it. Until we have that answer in writing, treat this as unresolved. We are not going to sell you on it.
These are the questions we have put to each provider:
- Is content sent through our paid API account used to train your models? Yes or no.
- If yes, can we turn that off, and does it apply to paying business accounts?
- How long do you keep the content of an API call, and where is it stored?
- Does your answer change when we are passing our customers' requests through the API rather than our own?
When we have answers, we will put the plain-English version right here, and we will tell you if your data flows anywhere new.
How long we keep things
- Your content on your own server: for as long as you are a customer.
- After you leave: 30 days, then we delete it.
- Backup copies: deleted with the rest at the end of those 30 days. We will give you the honest date rather than say “instantly”.
- Billing and tax records: [ACCOUNTING RECORDS YEARS] years, because Australian tax law makes us keep them. [to be confirmed]
Asking for a copy, or for deletion
Email [PRIVACY EMAIL]. Say what you want (a copy, deletion, or both) and we will do it without asking why. The full steps are in our deletion and handover procedure. If you are unhappy with how we handled it, email [COMPLAINTS EMAIL] and we will deal with it properly. You can also complain to the Office of the Australian Information Commissioner. [to be confirmed]
Contact
Steward · [ENTITY] · ABN [ABN] · [BUSINESS ADDRESS] · [CONTACT EMAIL] · [DOMAIN]
Effective [EFFECTIVE DATE]. Last updated [LAST UPDATED DATE].